Repository navigation
Detect and redact ordinarily grouped IBAN identifiers #260
Description
The safety helper migration in PR259 preserves a contiguous-uppercase IBAN regex in tinymemory-api/src/safety/rules.rs. Synthetic runtime evidence: scan on GB82 WEST 1234 5698 7654 32 returns level None with no hits; redact_identifiers returns the grouped value unchanged.
Extend matching/validation to ordinary permitted IBAN separators without broadening to arbitrary text, and preserve the complete original span for redaction. Add contiguous/grouped/case/invalid examples and confirm strong BankAccount risk plus full-span redaction. This detector correction is separate from unchanged-return/redaction relocation in tinyhumansai/openhuman#7418.
Activity
tinysweeper commentedon Oct 11, 2026
Grouped IBANs with ordinary separators (e.g. "GB82 WEST 1234 5698 7654 32") are missed by the safety rules: scan returns level None with no hits and redact_identifiers leaves the value unchanged, so sensitive bank identifiers can leak. Extend the detector to accept permitted IBAN separators and case variants while preserving the full original span for redaction, and add contiguous/grouped/invalid test cases. None of the candidate issues concern IBAN matching (they cover phone-rule counting, card/CVV boundaries, and phone digit counts), so no duplicate is named.
Labelled
priority: p1.